You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Register a free account to unlock additional features at BleepingComputer.com

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

I believe I have some problems, as I get 10 or so new viruses daily.I run AVG's free service and ran Trendmicro's Housecall.

Here is my HJT log and an Ewido anti-malware report that was run in safe mode.Paytime has recently returned. (This boot in fact)I cannot seem to stamp out ibm00001.exeShare-to-web-namespace-deamon.... I don't know what to make of it. It appears to be files HP wants to give me, but I made no request for such. This begins downloading files at boottime, with the option to cancel, which I take.

My searches are hijacked, I'll enter, say, "cheese" on yahoo, click on the link to the
American Dairy Association, and get something totally or vaguely unrelated, usually
requesting money.
I tried disabling third party browser stuff, but then I get a window that is constantly busy,
so I switched that option back.

I'm also contracting viruses while inactive. I've kept stamping out these fires as they crop up,
usually by means of a walkthrough provided by sites such as this.

I've run CWShredder, my AVG Free Edition, Ewido, Spyware Blaster, Spybot S&D,
Ad-aware, and Trendmicro Housecall, all according to the instructions posted by various
experts.

The forums are really busy, that explains why logs get behind. We start with the oldest logs first. If you still need some help, please start with posting a new hijackthislog in this thread. Don't start with a new thread.
Then I'll take a look.

Also, The current formatting of your log makes it difficult to read, so in notepad:
On top, click Format >uncheck Word Wrap

No worries about the timeframe, these problems are only annoying, not critical.

I have performed the required steps before posting an HJT log.My troubles are still as such:

HP Share to web software attempts to download 7 or 8 times every startup, I do not want it and wish it to cease. I have even allowed it to download, but it will repeat itself anyway.

All search engine links are hijacked to google with random and highly undesirable arguments entered into the search function. Alternatively, links lead to some sort of sponsored site. For example, searching for 'Cheese' gives a link to the American Dairy Association, but clicking said link leads to an online cheese store, distinct from the actual site. I must cut and paste links in order to bypass this.

Save it to your desktop and run it. Click Next, then Install, then make sure "Run fixit" is checked and click Finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.

When your system reboots, you'll see your desktop and taskbar won't load yet. This is normal, because it is still scanning. Please be patient.Afterwards, HijackThis will launch automatically. Please click Scan, and check the following items:

If you see an entry as well in your O4 lines in hijackthis, starting with dm... for example:O4 - HKLM\..\Run: [dm***.exe] C:\WINDOWS\system32\dm***.exe (the *** stand for random letters) or starting with hg... for example:O4 - HKLM\..\Run: [hg***.exe] C:\Windows\System32\hg***.exeCheck it as well. If not sure, leave it and only check the ones I asked you to check

Reg Entries that were deleted HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\xifmdHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\xedocneHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\gib_ogolHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwohHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llunHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\golmediHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23plhpsHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\mgcpppHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\tesvafHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\32refaselifHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\putesprpgd

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

To keep this clean in the future, I would suggest the following things:

Install SpywareblasterSpywareBlaster doesn`t scan and clean for so-called spyware, but prevents it from being installed in the first place. It blocks the popular spyware ActiveX controls, and also prevents the installation of any of them via a webpage.

* Avoid illegal sites, because that's where most malware is present.* Don't click on links inside popups.* Don't click on links in spam messages claiming to offer anti-spyware software; because most of these so called removers ARE spyware.* Download free software only from sites you know and trust. Because a lot of free software can bundle other software, including spyware.

And I do suggest you perform an online virusscan once in a while. (Housecall and/or Bitdefender). Because what one virusscanner can't find another one maybe can.Also make sure that your virusscanner, the one that is installed on your system is always up to date!